TI-2021-20068 CVE-2021-44458
Lack of websocket authentication in Lens causes remote code execution when visiting a malicious website
Priority MEDIUM 42
Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website.
Mirantis
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Mirantis records in CISA KEVNo Mirantis vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2022-00407 CVE-2022-0484 · GHSA-hr2m-fgfg-99wq
Improper URL Validation causes Mirantis Container Cloud Lens Extension to open external programs
Priority MEDIUM 40
Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster.
TI-2022-00204 CVE-2022-0270 · GHSA-r5c2-7hp9-v678
Improper header sanitization in bored-agent causes escalation of privilege
Priority MEDIUM 40
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
TI-2021-05979 CVE-2021-23218 · GHSA-3v69-r3x2-qgp5
Memory Leak in Mirantis Container Runtime (MCR) running in FIPS mode causes a Denial of Service
Priority LOW 35
When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a denial of service.
TI-2021-05936 CVE-2021-23154 · GHSA-j79q-frp5-24gc
Code injection in Mirantis Lens
Priority LOW 35
In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell.